This takes the block we had and says "take the extensions from a TLS CertificateRequest" instead. The nice trick here is that we can use SNI from the client side rather than leaning on the OID thing, which was always a long-shot.
I missed that you had an open PR for these changes -- sorry. I think in the meantime, I've made equivalent changes because you suggested them in e-mail.
This takes the block we had and says "take the extensions from a TLS CertificateRequest" instead. The nice trick here is that we can use SNI from the client side rather than leaning on the OID thing, which was always a long-shot.